What’s Vulnerable › Vulnerabilities

CVE-2020-13895

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-07 · updated 2026-06-17
• Weakness: CWE-347

Description

Crypt::Perl::ECDSA in the Crypt::Perl (aka p5-Crypt-Perl) module before 0.32 for Perl fails to verify correct ECDSA signatures when r and s are small and when s = 1. This happens when using the curve secp256r1 (prime256v1). This could conceivably have a security-relevant impact if an attacker wishes to use public r and s values when guessing whether signature verification will fail.

Affected products

• P5-Crypt-Perl Project P5-Crypt-Perl: before 0.32 — fixed in 0.32

How to fix

Upgrade to a fixed version: P5-Crypt-Perl Project P5-Crypt-Perl 0.32. Check the vendor advisory for mitigations.

References

• https://github.com/FGasper/p5-Crypt-Perl/commit/f960ce75502acf7404187231a706672f8369acb2
• https://github.com/FGasper/p5-Crypt-Perl/issues/14
• https://github.com/FGasper/p5-Crypt-Perl/commit/f960ce75502acf7404187231a706672f8369acb2
• https://github.com/FGasper/p5-Crypt-Perl/issues/14

Get alerted when CVE-2020-13895 or the next vulnerability affects your stack